PIC32MX Unlock | Feasibility, Cost & Turnaround

PIC32MX Unlock: Recovering Firmware from Code-Protected Microchip MCUs

PIC32MX unlock refers to the authorized extraction of firmware from Microchip’s PIC32MX family of 32-bit MIPS-based microcontrollers when the code-protection (CP) configuration bits have been set. Our engineers recover flash contents from PIC32MX devices for clients who own the IP but have lost source code, need to support legacy hardware, or must verify production programming. Typical turnaround is 5–10 working days, with costs starting around USD 500 for common variants and rising to USD 3,000+ for parts with advanced protection or small-geometry die.

How Does PIC32MX Code Protection Work?

Microchip’s PIC32MX series implements code protection through configuration fuses stored in the Boot Flash Configuration (BFC) region. When the CP bit is programmed, the ICSP/JTAG debug interface blocks read-back of program flash and, on some variants, boot flash. The protection operates at the hardware level inside the flash controller — a bulk erase is required before the debugger can regain read access, which destroys the firmware in the process.

Key protection details vary across the PIC32MX sub-families:

Parts with larger flash and the BWP fuse active require more invasive techniques because the boot region — which holds startup code and configuration — is independently locked. The 5xx/6xx/7xx series, common in USB and Ethernet designs, often combine CP with write-protect partitions, adding another layer our team must address.

What Makes PIC32MX Unlock Feasible?

Unlike some ARM Cortex-M devices that implement TrustZone or multi-level readout protection with voltage-glitch countermeasures, the PIC32MX relies primarily on configuration-fuse-based gating. This architecture is well-characterized after more than a decade in production (the family launched in 2007). Our lab has documented the flash controller behavior across 40+ PIC32MX part numbers.

Techniques We Apply

• Microprobing: Direct contact with internal flash bus lines after chemical or laser decapsulation. Effective on the 130 nm and 150 nm process nodes used by most PIC32MX parts.
• Fault injection: Precisely timed voltage or electromagnetic glitches during the boot-sequence security check to bypass the CP gate before the flash controller locks the read path.
• Debug-port exploitation: On certain early-revision silicon (mask revisions A1–A3 of PIC32MX3xx/4xx), known errata in the EJTAG TAP state machine can be leveraged to read flash sectors without triggering the bulk-erase requirement.

Not every technique applies to every variant. During our free feasibility assessment we identify the exact die revision (via package markings and, if needed, a test decap) before committing to a method.

PIC32MX Unlock Cost and Turnaround

Pricing depends on the sub-family, flash density, and whether the part has additional write-protection fuses enabled. Below are representative ranges — final quotes are provided after feasibility review.

We charge nothing if the extraction fails. A refundable deposit secures your slot in the queue; the balance is due only upon delivery of a verified binary.

Deliverables You Receive

• Raw binary image (.bin / .hex) of program flash, boot flash, and configuration words.
• Configuration-bit map showing oscillator settings, peripheral pin select, watchdog, and protection fuses — critical for re-programming onto a blank PIC32MX.
• Verification report with CRC-32 checksums and, where the client supplies a known-good unit, a diff summary confirming byte-level match.
• Optional: disassembly listing (MIPS32 assembly) if the client needs to audit or modify the recovered code.

When Is PIC32MX Unlock the Right Move?

Legitimate use cases we handle regularly:

• Lost source code. An original developer left the company; the only copy of firmware lives inside production units.
• Legacy equipment maintenance. Industrial controllers, medical peripherals, or automotive test jigs running PIC32MX need spare programmed MCUs, but the programming files were never archived.
• Design audit. A company acquiring IP through M&A needs to verify that the firmware on shipped boards matches the source repository.
• Prototype recovery. A pre-production prototype contains the only working build of a firmware branch that was never merged.

We require proof of ownership or written authorization before starting work. Every engagement is covered by our mutual NDA. For details on our legal framework, visit our trust and authorization policy page.

PIC32MX vs. Other Microchip Families

If your target device is an 8-bit or 16-bit PIC rather than a PIC32MX, the protection mechanisms and unlock techniques differ significantly. The PIC16F18 series, for example, uses a simpler CP fuse but a different flash architecture — see our PIC16F18 unlock guide for specifics.

For projects involving external serial EEPROMs paired with a PIC32MX — a common design pattern in industrial controls — we can also extract data from companion memory ICs. Our team routinely handles devices like the 24C256 serial EEPROM and AT24C512 alongside the main MCU.

Failure Modes and Honest Limitations

Transparency matters. Here is what can go wrong:

• Die damage during decapsulation. PIC32MX packages (TQFP-44/64/100, QFN) are generally robust, but moisture-damaged or corroded parts have a 5–8% decap failure rate.
• Newer silicon revisions. Microchip occasionally hardens the flash controller in later mask revisions without changing the part number. A technique that works on rev A3 may not work on rev B1. We mitigate this by requesting two sample units when possible.
• Encrypted bootloader overlays. Some OEMs add a software-level AES encryption layer on top of hardware CP. We can extract the encrypted binary, but decryption requires the key — which may reside in OTP fuses or an external secure element.
• One-Time Programmable (OTP) parts. A small number of PIC32MX variants were shipped in OTP packages for automotive qualification. These have different flash cell structures and lower unlock success rates.

We flag all known risks during the feasibility stage so you can make an informed go/no-go decision before any cost is incurred.

How to Get Started with PIC32MX Unlock

1. Submit your request. Provide the full part number (e.g., PIC32MX270F256B-I/SO), quantity of sample units available, and a brief description of the use case.
2. Feasibility review (free). Our engineers assess the specific die revision and protection configuration. We return a go/no-go recommendation within 1–2 working days.
3. Ship samples. Send 1–3 units (we recommend 2 for redundancy) to our lab. We provide a prepaid shipping label for select regions.
4. Extraction and verification. We perform the unlock, verify the binary, and deliver files via encrypted transfer.
5. Re-programming support (optional). We can supply a programming script and configuration-bit file compatible with Microchip’s MPLAB IPE or PICkit 4.

Related MCU Unlock Services

Engineers working with mixed-vendor BOM designs often need firmware recovery from multiple IC families in a single project. Beyond PIC32MX, our lab supports a wide range of 32-bit MCUs:

• nRF52840 unlock — Nordic’s BLE SoC with APPROTECT readout protection.
• GD32E230 unlock — GigaDevice’s Cortex-M23 with SWD lock.
• STM32WB55 unlock — ST’s dual-core wireless MCU with RDP Level 1/2.

Related reading

• Oct 2026Maxim IC Unlock | Families We Can Read & Recover
• Oct 2026Dialog IC Unlock | Families We Can Read & Recover
• Oct 2026Nordic IC Unlock | Families We Can Read & How